Solido Money revealed that about 84% of the funds stolen in its recent exploit moved through centralized exchange infrastructure. The firm is now seeking cooperation from these exchanges to help freeze and recover the stolen assets.
Two phases of the attack uncovered
The forensic report reconstructs the July 23 hack by analyzing blockchain data. It shows the attacker executed two distinct waves that exploited the same oracle pricing error, minting a total of 809,052 CASH tokens and netting 293.7 million SUPRA tokens.
The vulnerability arose because the protocol assigned collateral a value close to one U.S. dollar, while its actual market price was only a small fraction of that. The attacker took advantage by creating CASH tokens based on this inflated collateral value, then selling them for SUPRA.
In the first wave, the attacker used a single atomic transaction. Hours later, the same method was repeated manually across five separate wallets. Solido emphasizes that the root cause was an oracle misassignment combined with inadequate risk controls, ruling out reentrancy or market manipulation.
The report tracks roughly 246.9 million SUPRA, or 84% of the stolen proceeds, as they passed through centralized exchanges. Among these, about 220 million SUPRA appear linked to a suspected deposit address on Gate.io, though Solido notes this attribution is tentative and requires exchange confirmation. A second exchange-related address received additional funds from the later exploit, consolidated into an omnibus wallet.
Solido clarified these findings are based on blockchain behavioral analysis and do not accuse any exchanges of knowingly supporting the theft.
In response, Solido called on exchanges to verify whether the flagged addresses belong to their platforms, to freeze any deposits tied to the incident, and to preserve relevant account information for law enforcement. The protocol also took contract-level measures, disabling the vulnerable minting function to prevent further breaches.
This material is for informational purposes and does not constitute financial advice.
